WordPress 7.1.4 fixes unauthenticated upgrade-window RCE under attack
Original title: WordPress 7.1.4 Patches Unauthenticated Upgrade-Window RCE; Exploitation Attempts Detected After Release
Core 4.7 through 7.1.3 is affected; attackers poll a seconds-long staging window during full updates.
WordPress 7.1.4, released October 28, 2026, fixes 22 Core issues, including stored cross-site scripting, denial of service, information disclosure, and authorization bugs. The most serious is an unauthenticated race during complete Core updates: files are unpacked under a predictable wp-content/upgrade path, and requesting the staged installer in that short window can lead to PHP execution. Wordfence says attackers are already trying to catch the window. Paid Wordfence firewall rules shipped the same day; free users are scheduled for November 27, 2026.
Unconfirmed: Wordfence reports exploitation attempts, not confirmed successful compromises of specific sites.
- Wordfence rates the flaw CVSS 8.1; lab windows lasted only seconds.
- Patched releases include 7.1.4, 7.0.8, 6.9.11, and branches back to 4.7.39.
- Researcher credited for the issue is Umut Bayram.
- The Wordfence rule went out at 20:30 UTC on October 28, 2026.
- The exploit requests a staged PHP file without first loading WordPress.
Impact: Unauthenticated code execution during a Core upgrade
| Product | Affected | Fixed in |
|---|---|---|
| WordPress Core | 4.7 through 7.1.3 | 4.7.39, 4.8.34, 4.9.35, 5.0.31, 5.1.28, 5.2.30, 5.3.27, 5.4.25, 5.5.24, 5.6.23, 5.7.21, 5.8.19, 5.9.20, 6.0.18, 6.1.16, 6.2.15, 6.3.14, 6.4.14, 6.5.14, 6.6.11, 6.7.11, 6.8.12, 6.9.11, 7.0.8, 7.1.4 |
- 1.Update to WordPress 7.1.4 or the patched release for the installed branch.
- 2.With Wordfence, enable Extended Protection so the firewall runs before direct PHP requests.
- Vendors
- WordPress
- Products
- WordPress Core
- Organizations
- Wordfence
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| privacy@defiant.com | . Close Questions? Contact our Privacy Team at: • Email:privacy@defiant.com • Mail: Defiant Inc. Attn: Privacy Issues, 1700 Westlake Av |
From the original article
11 min read at wordfence.com
TL;DR: WordPress 7. 1. 4 was released on October 28, 2026.
By Alex Thomas · wordfence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.